CVE-2023-32549 Landscape insecure token generation

Landscape cryptographic keys were insecurely generated with a weak pseudo-random generator...

CVE-2023-0558

The ContentStudio plugin for WordPress is vulnerable to authorization bypass due to an unsecure token check that is susceptible to type juggling in versions up to, and including, 1.2.5. This makes it possible for unauthenticated attackers to execute functions intended for use by users with proper...

Golf 跨站请求伪造漏洞

Golf is a fast, simple, and lightweight web framework for individual developers at Peixuan Ding. Golf suffers from a cross-site request forgery vulnerability that stems from an insecurely generated CSRF token. An attacker can exploit this vulnerability to predict CSRF tokens...

Insecure Token

Pac4j has insecure token. The vulnerability exists due to an insecure validation of ID token with "none" algorithm allowing an attacker to bypass the token validation by injecting a maliciously crafted ID token by setting the alg key = "none"...

Insecure Token

jakarta.el is vulnerable to Insecure Token. The vulnerability exists due to a bug in the ELParserTokenManager which enables invalid EL expressions to be evaluated as if they were valid...

PRODSECBUG-2171: Insecure token implementation leads to Cross-Site Request Forgery (CSRF)

More info at https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-33...

Apache Guacamole Information Disclosure Vulnerability

Apache Guacamole is a clientless remote desktop gateway from the American Apache Apache Software Foundation. The product supports protocols such as VNC, RDP and SSH. A security vulnerability exists in Apache Guacamole versions 0.9.4 through 0.9.14, which stems from the program's failure to use th...

CVE-2018-14709

Incorrect access control in the Dashboard API on Drobo 5N2 NAS version 4.0.5-13.28.96115 allows attackers to bypass authentication due to insecure token generation...

CVE-2018-14709

Incorrect access control in the Dashboard API on Drobo 5N2 NAS version 4.0.5-13.28.96115 allows attackers to bypass authentication due to insecure token generation...

CVE-2018-14709

CVE-2018-14709 affects Drobo 5N2 NAS (Dashboard API) where insecure token generation allows authentication bypass. Public details in the provided documents indicate remote command injection via the NASd service, enabling attackers to perform actions such as querying device status, installing appl...

CVE-2018-14709

Incorrect access control in the Dashboard API on Drobo 5N2 NAS version 4.0.5-13.28.96115 allows attackers to bypass authentication due to insecure token generation...

PT-2018-9393

Name of the Vulnerable Software and Affected Versions Cobbler versions 2.0.0 through 2.6.11+ Description The issue concerns an Incorrect Access Control vulnerability in the XMLRPC API, specifically at the /cobbler api endpoint. This can lead to privilege escalation, data manipulation or...